SHA-256 vs MD5: Which Hash Function Should You Use?

The Day MD5 Actually Broke

In 2004, a team of Chinese cryptographers led by Xiaoyun Wang published a paper that changed how the security world treated MD5 forever. Wang's team demonstrated a practical method for generating two different input files that produced the exact same MD5 hash, a collision, and they could do it in hours on ordinary hardware of the time, not the billions of years the algorithm's 128-bit output was supposed to require. By 2008, researchers extended the attack to forge a fraudulent SSL certificate that browsers trusted as genuine, proving collisions were not just an academic curiosity but a real path to breaking trust systems people relied on every day. MD5 has not gotten any better since. If anything, cheap GPU power has made every attack against it faster. This single piece of history is the reason MD5 appears on almost every "do not use" list in cybersecurity, and it is worth understanding exactly what broke and why, because the same lesson applies to SHA-1 today and will eventually apply to SHA-256 decades from now.

Quick Comparison

What a Hash Function Is Supposed to Do

A cryptographic hash function takes an input of any size and produces a fixed-size output, called a digest, with four properties that any secure hash must hold:

• Deterministic: the same input always produces the same output, every time, on every machine
• One-way: you cannot work backward from the output to recover the original input
• Avalanche effect: a tiny change to the input produces a completely different, uncorrelated output
• Collision resistant: it should be computationally infeasible to find two different inputs that produce the same output

Wang's 2004 research broke that last property for MD5 specifically. The other three properties still technically hold, MD5 is still deterministic and still one-way for practical purposes, but collision resistance is the property that security depends on most, and once it falls, digital signatures, certificate validation, and any scheme that assumes "identical hash means identical file" becomes unsafe.

Seeing the Avalanche Effect Firsthand

The avalanche effect is easiest to understand by looking at real output. Here are the SHA-256 hashes of two nearly identical strings, differing by a single changed letter:

Input:  "2fafast"
SHA-256: e6a51d19f8b00196368e5151b5a89ba9a5b5597a69573966c5bef220e9bef76a

Input:  "2fafast!"
SHA-256: 82c58ccabc2904716d1d8b9e59e5c4ff17e5f60ea2ebb3da353edc432999203a

Adding a single exclamation mark to the end of the input produces a completely unrelated-looking output. Not one character overlaps in a predictable way, and there is no way to look at the two hashes and guess that the inputs were nearly identical. That is the avalanche effect working correctly, and it holds true for MD5, SHA-1, and SHA-256 alike. The difference between a broken hash and a secure one is not whether the avalanche effect exists, it is whether an attacker can deliberately engineer two different inputs to land on the exact same output despite that avalanche behavior. For MD5, they can. For SHA-256, as of today, nobody has found a way.

Why MD5 Is Broken for Security, in Detail

• Collision attacks: following Wang's 2004 breakthrough, later refinements brought collision generation down to seconds on an ordinary laptop. Tools like this have been used to create pairs of files, executables, PDFs, even certificates, that are functionally different but hash identically.
• Chosen-prefix collisions: a more dangerous variant lets an attacker pick two arbitrary starting documents (say, a legitimate contract and a fraudulent one) and then append carefully crafted data to each so that both end up with the same MD5 hash. This is what made the 2008 rogue certificate attack possible.
• Rainbow tables: massive precomputed tables mapping common passwords to their MD5 hashes are freely available. Cracking an MD5-hashed password with no salt is often instantaneous, a simple table lookup rather than a brute-force search.
• Speed works against it: MD5 was designed to be fast, which is exactly wrong for anything security-sensitive. Modern GPUs compute many billions of MD5 hashes per second, making brute-force search practical even without a rainbow table.

The US government formally deprecated MD5 for security use in 2008, the same year the rogue certificate attack was demonstrated publicly, and every major cryptography body has echoed that guidance since.

When MD5 Is Still Genuinely Acceptable

None of this means MD5 is useless everywhere. Its speed is a real advantage outside adversarial contexts, and it remains common in these situations:

• Non-adversarial file checksums: confirming a large download completed without corruption, where you already trust the source and nobody is trying to forge a matching file
• Cache keys: turning a long string, like a URL or a database query, into a short, consistent identifier for lookup tables
• Deduplication: finding duplicate files or records in a system you control, where nobody has an incentive or opportunity to engineer a deliberate collision
• Non-cryptographic hashing: hash maps and general-purpose fast lookups where the goal is speed and distribution, not security

The dividing line is simple: if an adversary could benefit from deliberately crafting a collision, MD5 is unsafe. If the hash only needs to catch accidental corruption or provide a fast, unique-ish key in a trusted environment, MD5's speed makes it a reasonable, if slightly old-fashioned, choice. When in doubt, SHA-256 costs very little extra compute and removes the question entirely.

SHA-256: The Modern Standard

SHA-256 belongs to the SHA-2 family, designed by the NSA and standardized by NIST. As things stand today:

• No known collision attacks exist against it
• No known preimage attacks exist against it
• It is recommended by NIST, every modern browser, TLS 1.3, and effectively all current security standards
• It underpins Bitcoin's proof-of-work, which has secured trillions of dollars in value since 2009 without a single cryptographic break of the hash function itself

Use Cases: Which Hash Function to Choose

Never Use MD5 or SHA-1 for Passwords

Storing passwords as MD5 or SHA-1 hashes, even with a salt attached, is dangerously insufficient. Read our guide on salt in cryptography for why salting alone does not fix this. These algorithms are built for speed, which is precisely what makes them easy to brute-force at scale. Always use a purpose-built password hashing algorithm instead: Argon2id is the current best practice, with bcrypt and scrypt as solid, well-tested alternatives. If you want the broader picture of how hashing fits into security beyond just these two algorithms, see our beginner's guide to hashing.

Try Our Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly with our free Hash Generator. All computation happens entirely client-side in your browser, nothing is ever sent to our servers.

Frequently Asked Questions

Is SHA-256 safe forever?

No hash function is safe forever, MD5 looked unbreakable in 1991 too, but SHA-256 currently has no known weaknesses and is expected to remain secure well beyond 2030. SHA-3, a structurally different design from SHA-2, exists as a future-proofing option, but SHA-256 remains the standard recommendation today.

Why is SHA-1 still used in TOTP if it is deprecated?

SHA-1 is deprecated specifically for digital signatures and certificate use, where the known collision attacks matter. Inside an HMAC construction, HMAC-SHA1, the security proof is different, and HMAC's design prevents the collision attacks that broke SHA-1 elsewhere from applying here. TOTP relies on HMAC-SHA1 as its RFC-defined standard, and that combination has not been broken.

What is the difference between SHA-256 and SHA-2?

SHA-2 is the family name, SHA-256 and SHA-512 are individual members of it. SHA-256 produces a 256-bit digest and SHA-512 produces a 512-bit digest. The family also includes SHA-224, SHA-384, SHA-512/224, and SHA-512/256. SHA-256 is by far the most widely deployed member.

Should I use SHA-256 or SHA-512?

SHA-256 is the generally recommended default for most applications. SHA-512 runs marginally faster on modern 64-bit CPUs and offers a larger security margin. Unless you have a specific performance or compliance reason to pick one over the other, SHA-256 is the safe, standard choice.

Could SHA-256 ever suffer a collision attack like MD5 did?

In theory nothing is mathematically impossible, but SHA-256 has been public and heavily scrutinized by cryptographers since 2001 with no collision found, unlike MD5, which fell within roughly a decade of public analysis. The security margin SHA-256 currently holds is considered comfortable for the foreseeable future, which is why it, rather than MD5 or SHA-1, is the baseline in virtually every modern standard.